Code Injection Vulnerability in Roo Code AI-Coding Assistant

CVE-2025-57771

What is CVE-2025-57771?

Roo Code, an AI-powered autonomous coding assistant, has a code injection vulnerability in versions prior to 3.25.5 due to improper handling of process substitution and ampersand characters within its command parsing logic. This issue can allow attackers to execute arbitrary commands when users enable auto-approved command execution. Although this feature is disabled by default, if exploited, it can lead to significant security risks as it permits the execution of unintended commands when the operator's input is manipulated. The vulnerability has been addressed in the latest version, enhancing the security of users' development environments.

References